rstoyanchev
commented
8 years ago And you are aware that Spring Security already has this feautre? http://docs.spring.io/spring-security/site/docs/current/reference/html/websocket.html
Open achmadns opened 8 years ago
rstoyanchev
commented
8 years ago And you are aware that Spring Security already has this feautre? http://docs.spring.io/spring-security/site/docs/current/reference/html/websocket.html
achmadns
commented
8 years ago Thank you for your quick response. I just get to know that feature. Unfortunately I still can't find my solution. After a subscription is filtered only for any principal that has role 'USER', I need to add additional step, to make sure one to one relationship between queue and user . Let's take an example, subscription is success if the destination contains the username that is being subscribed to achieve specific queue per user and allow only specific user accordingly. Here is the illustration:
@Override
protected void configureInbound(MessageSecurityMetadataSourceRegistry messages) {
messages
.nullDestMatcher().authenticated()
.simpDestMatchers("/queueu/**").hasRole("USER").addInterceptor(
new MessageSubscriptionInterceptor(){
public void intercept(SessionSubscribeEvent subscription, WebSocketHandler wsHandler, Principal principal, Map<String, Object> attributes){
final String destination = (String) subscription.getMessage().getHeaders().get("destination");
if(!destination.contains(principal.getName().toLowerCase())){
subscription.cancel("UNAUTHORIZED ACCESS!");
}
}
}
)
.simpTypeMatchers(MESSAGE, SUBSCRIBE).denyAll()
.anyMessage().denyAll();
}Anyway, thank you. Spring team makes developer's life easier.
ghost
commented
8 years ago Regarding your need "additional step, to make sure one to one relationship between queue and user", I originally thought our product needed to enforce one to one, in order to avoid collisions, however I learned that session IDs can handle that. See "User Destinations" section of the Websockets user guide. http://docs.spring.io/spring/docs/current/spring-framework-reference/html/websocket.html
For example, a client might subscribe to the destination "/user/queue/position-updates". This destination will be handled by the UserDestinationMessageHandler and transformed into a destination unique to the user session, e.g. "/queue/position-updates-user123". This provides the convenience of subscribing to a generically named destination while at the same time ensuring no collisions with other users subscribing to the same destination so that each user can receive unique stock position updates.
Dear @rstoyanchev , I created something like "How not to use SockJS". Now I need to create 'Authorization' feature so that user A can only subscribed into '/amq/queue/user.a', and user B can only subscribed into '/amq/queue/user.b' identified by 'access_token' upon handshake.
I tried to play around with
ApplicationListener<SessionSubscribeEvent>and tried to implement whatStompSubProtocolHandler.afterSessionEnded()did yet still no luck. It is based on stupid guess actually. Could you please give me pointer?Executing this code:
Got NPE:
Thanks in advance.